The Morning Dev

Only the news worth knowing

‹
 
C24/100

Vulnerability · high

Disputed OpenSSH and musl password authentication bypass claims debated

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Alpine openssh-server users and OpenSSH on musl libc with password authentication

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool

What to do

  1. Read the Alpine Linux advisory and check whether your openssh-server installation is affected

The Brief

  • Alpine Linux published an advisory on 2026-11-05 about an openssh-server password authentication bypass.
  • The bypass claims involve OpenSSH and musl libc and were debated on the oss-sec mailing list on 2026-11-07.
  • The claims are disputed: a raw measurement log was published, and a libxcrypt edge case was noted where the failure token is "*" if the buffer is only two bytes, with unclear real-world impact.

Why it matters

If the bypass is confirmed for your setup, password logins on affected OpenSSH systems could be bypassed, so check whether your systems use OpenSSH with password authentication on musl libc.

The checklist behind the tier

Checklist · 3 of 10 yes
YesHits tech teamsJudgment: OpenSSH server is run by ops and IT teams and ships in Alpine Linux.
YesCore infrastructureJudgment: OpenSSH is core infrastructure nearly every team runs.
YesPopular toolJudgment: OpenSSH is a widely used tool; core infrastructure implies yes.
NoExploited in the wildSources only debate claims and measurements; no source reports observed attacks.
NoPublic exploitOpen Source Security posts share raw measurement logs and code analysis, not a stated working exploit or PoC.
NoRemote, no loginSources dispute the bypass claims; none confirms unauthenticated remote exploitation.
NoFull takeoverSources do not confirm code execution, root access or account takeover; the claims are disputed.
NoSecrets exposedNo source reports credentials, keys, configs or data being stolen or exposed.
NoSupply chainSources describe an authentication bypass in software, not compromised packages, updates or pipelines.
NoNo fix yetAlpine Linux posted an advisory on 2026-11-05; no source says no fix exists.

Timeline

  1. Alpine Linux publishes advisory on openssh-server password authentication bypass

  2. Bypass claims debated on oss-sec and raw measurement log published

  3. Lobsters

    Alpine Linux : openssh-server password authentication bypass

  4. Open Source Security

    Re: "sshole": password authentication bypass: OpenSSH + musl libc · +1 reply

Full coverage · 3 sources

First seen · 3 sources · Full story page · How tiers are decided